Pre-positioning — reading intent from an intrusion that does nothing

Filed under idea in proposals.md; written here as interpretation. The id sits in the idea section with the rest of the batch appended on 2026-08-17, which has since come out as four different kinds. The section is where these were written down, not what they are.

The kind still has to be argued, because both alternatives are live.

Why not idea. The canon's idea is "a framing later work is built out of rather than argued about." The second half fails at the root. This framing is not merely debated at the edges; it is denied outright by one government and called conjecture by serious people in the other. China's National Computer Virus Emergency Response Center published three reports across 2024 arguing the whole thing is an American fabrication. Stephen Roach — a China economist, not a carrier of Beijing's talking points — wrote on 27 February 2024 that the FBI was "basing its very public alarm purely on conjecture about China's future intent," and reached for the Iraq WMD precedent. Something contested at the level of did this happen is not an inheritance.

Why not moment. This is the close call, and the sibling entry went the other way: apt1-attribution-2013 is moment because what the project needs from it is the event and the standard the event set. Here the project does not need "on 7 February 2024, ten agencies published an advisory." It needs the inference: presence without effect, read as intent. The advisory is the vehicle; the reading is the cargo. The id says as much — pre-positioning-volt-typhoon puts the concept first and the case second, and the concept is older and wider than the case.

Why interpretation fits. The kind is "a reading of events that a reading may need to name." The events here are forensic: an actor inside networks, doing very little, for years. The reading is that the doing-very-little is the point. A reading of this project needs to name that inference precisely when it is holding a capability that has not done anything yet and has to decide what it is worth — which, as section 2 shows, it was doing twelve hours before this entry was written.

What it is

On 24 May 2023 Microsoft Threat Intelligence published an account of an intrusion set it named Volt Typhoon, active since mid-2021, inside critical-infrastructure organisations "in Guam and elsewhere in the United States." The actor's method was what the trade calls living off the land: no custom malware, no distinguishing tooling, only the administrative utilities already present on the machine — PowerShell, wmic, ntdsutil, netsh — which is a way of being indistinguishable from a system administrator having an ordinary day. Microsoft's assessment of purpose came in two sentences that point in different directions, and both are in the same post. The observed behaviour, it said, "suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible." And: "Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises."

The same day, NSA, FBI and CISA with the Australian, Canadian, New Zealand and British cyber centres issued a joint advisory (AA23-144A) on the technique. It is a technical document about detection. It does not argue about intent.

Eight months later the argument arrived. On 31 January 2024 the Justice Department announced a court-authorised operation — the order obtained in December 2023 — that deleted malware known as the KV Botnet from hundreds of end-of-life Cisco and NetGear small-office routers, which the actor had been using to make its traffic look domestic. Christopher Wray, then FBI Director: "Working with our partners, the FBI ran a court authorized network operation to shut down Volt Typhoon and the access it enabled." That same day, testifying to the House Select Committee on the CCP, he made the claim the whole framing now rests on: "China's hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities" — in the fuller delivery, "if and when China decides the time has come to strike."

A week later, on 7 February 2024, came the document itself: **AA24-038A, *PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure***, from CISA, NSA and FBI with DOE, EPA, TSA and the four allied centres — ten bodies. Three sentences in it carry the interpretation:

• The conclusion. "PRC state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure … in the event of a major crisis or conflict with the United States."
• The confidence. The authoring agencies "assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions" — a two-step escalation from Microsoft's moderate, made in eight months.
• The load-bearing premise. "Volt Typhoon's choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations."

Alongside it: access maintained "within some victim IT environments for at least five years"; confirmed compromises concentrated in Communications, Energy, Transportation Systems, and Water and Wastewater Systems, across the continental and non-continental United States and its territories, Guam included; and, in one case, access to camera surveillance systems at critical-infrastructure facilities. On 19 March 2024 the same agencies plus the US Treasury — eleven now — published a plain-language fact sheet for executives, which contains the sentence that explains why removing malware does not remove the problem: "Volt Typhoon does not rely on malware to maintain access to networks and conduct their activity. Rather, they use built-in functions of a system."

The shape of the inference is what matters here, and it is worth setting out plainly, because it is not the shape most security findings have. The conclusion is built from four observations and one absence.

1. Target selection with no intelligence value. A municipal water utility in Massachusetts holds no secrets. It holds a town's water. Sector concentration in the four things a country needs to move soldiers and keep the lights on, and geographic concentration on Guam — the staging base for any Taiwan contingency — is a pattern that fits a war plan and does not fit a collection requirement. 2. Behaviour after access. The advisory, quoting industry reporting: the actors "are silent on the network following credential dumping and perform discovery to learn about the environment, but do not exfiltrate data," which indicates "their aim is to achieve and maintain persistence on the network." 3. What they took when they did take something. Dragos's case study of the Littleton Electric Light and Water Departments intrusion, published March 2025, found the actor collecting data on OT systems — operating procedures, and geographic-information-system data giving the spatial layout of grid operations. That is targeting material. It is worth nothing to a spy and everything to a planner. 4. Duration and method. Years of quiet, achieved by using nothing that could be detected as foreign.

And the absence: no exfiltration of the kind espionage produces, and no disruption. The conclusion is drawn from a shape, not from an act. There is no captured order, no tool built for destruction, no statement of intent. There is a pattern of behaviour that fits one hypothesis better than the other, held at high confidence, about a foreign government's future decisions.

The entry it descends from is apt1-attribution-2013, and the descent is worth naming because it runs in an unexpected direction. Mandiant's 2013 report worked by punishing bad operational security: the operators logged into social media from their own attack infrastructure and had been reusing handles since 2004, and publishing that is what made the attribution checkable. The industry's own reading of the decade since is that the answer to being named was better tradecraft, not less activity — and living-off-the-land is precisely what better tradecraft produced. So Volt Typhoon is what an adversary looks like after it has read the APT1 report. There is almost nothing to publish. Which means the part APT1 made checkable — who — is settled here by five vendors independently, while the part it never had to argue — why — is the part carrying all the weight, and that part has no indicators.

Why a reading would cite it

The occasion is not hypothetical and it is not old. Twelve hours before this entry was written, the 00:00 reading of 19 August 2026 moved the needle from −3 to −2 and wrote down its reason:

> The pessimistic column is strong but it is mostly a capability — a threshold that > may have been crossed, on a model nobody outside has evaluated, which has not been > deployed and has not done harm — plus a loss statement. Under this project's own > ranking that asymmetry has to count.

That is a good rule and a defensible move. It is also the rule this entry breaks. Apply it to Volt Typhoon and the finding scores approximately nothing: no incident, no victim, no outage, no number, no deployment, no harm. Ten agencies at high confidence, five years of access inside American water and power, and by the ranking that discounted Astra, it rounds to zero.

The entry does not exist to overturn that rule. It exists so that a reading applying it has to say out loud which of two cases it is in.

• The Volt Typhoon case. The capability's presence is the finding, because presence is the whole objective and effect would be a categorically different event — a war. Waiting for the effect means waiting for the exact thing the finding existed to see coming. Here, discounting the unexercised capability is discounting the only evidence the situation can produce.
• The Y2K case. A forecast catastrophe whose non-arrival is equally compatible with "it was overstated" and "the remediation worked," where waiting for the effect is correct because the effect was the claim. y2k-2000 sits in proposals.md proposed by the owner and is not yet written; it is the sibling this entry most needs and does not have, and a reading that wants the other half of this argument should note that the canon cannot yet supply it.

Which case a given finding is in is a judgment. The use of this entry is to force a reading to make that judgment explicitly, rather than let a scoring habit make it silently. A reading that writes "it has not been deployed and has not done harm" is making a claim about the class of thing in front of it, and this entry is the standing example of a class where that sentence is true and irrelevant.

Second use, narrower and sharper. LENSES.md says record the magnitude, never the consequence. Volt Typhoon is the hardest case that rule will ever meet, because the magnitude and the consequence are stated in one sentence at one confidence level by one authority. "Access maintained for at least five years across four sectors" is a magnitude. "In order to disrupt functions during a conflict with the United States" is a consequence. The advisory does not separate them, and a reading that cites the advisory inherits the fusion unless it deliberately breaks it. This entry supplies the grading that lets a reading take the first, label the second as an assessment, and say who made it and at what confidence.

Third use. LENSES.md warns that without the magnitude rule "the pessimistic reading wins by being the more speculative one, which the record would then mistake for evidence." This entry is the standing counterexample to the comfortable version of that warning: here the official, institutional, ten-agency reading is the speculative one — and it may well be right. The rule is about form, not about which side is being careless.

What it got right, and what it got wrong

Not required for interpretation, but this is a dated claim about the world and it is now three years and three months old. It grades.

Right

1. The intrusions are real and the attribution has held under independent scrutiny. Microsoft named it Volt Typhoon (May 2023). Palo Alto's Unit 42, tracking the same actor as Insidious Taurus, published on 14 February 2024: "Based on the available public information, Unit 42 assesses Insidious Taurus as a top tier, sophisticated APT. We concur with the attribution made in both Joint Cyber Security Advisories." Dragos tracks it as VOLTZITE and produced a named victim and a case study. Lumen's Black Lotus Labs documented the KV botnet and, in August 2024, the exploitation of a Versa Director flaw (CVE-2024-39717) to plant credential-harvesting web shells, attributed to the same actor at moderate confidence. CrowdStrike has it as VANGUARD PANDA, Secureworks as BRONZE SILHOUETTE. Five vendors, six naming schemes, one actor, no serious Western dissent on identity.

2. The persistence claim was vindicated concretely, and by a third party. The LELWD intrusion began in February 2023, was discovered before Thanksgiving that year while the utility was deploying OT monitoring, and had run over 300 days in a small municipal electricity and water provider. The five-year claim in the advisory is unverifiable from outside; the 300-day case is documented, dated and attributed, and it is the kind of instance the general claim predicts.

3. The prediction that the presence would persist has held for two and a half years past the takedown. Rob Lee of Dragos, quoted by The Record on 19 February 2026: they are "still very active, and they're still absolutely mapping out and embedding in U.S. infrastructure," and — the sentence a reading should keep — "we're going to have to live with the reality that a portion of our infrastructure is currently compromised." Lee's added point is the one that makes the whole thing hard to score: large electricity companies have the sophistication to find this; water utilities largely never will, so some compromises "we will never find."

4. It is not only an American reading, and the corroboration got stronger rather than weaker. Note first what the 2024 co-seals actually said: the fact sheet's own footnotes record that CCCS assessed Canada "would likely be affected as well, due to cross-border integration," and that ASD's ACSC and NCSC-NZ assessed their national infrastructure "could be vulnerable to similar activity." Those are assessments of exposure, not reports of observation — a logo on a document is not a second intelligence service's finding, and reading it as one is a common error. But on 12 November 2025, ASIO's director-general Mike Burgess told an ASIC forum in Melbourne that authoritarian states are inside Australia's water, transport, telecommunications and energy networks and "actively and aggressively" mapping them to enable sabotage at a time of their choosing, citing Volt Typhoon's Guam campaign as the model, and said Australia is at "the threshold for high-impact sabotage." That is an allied service claiming its own observation, and it is worth considerably more than the co-seals were.

5. The takedown was described modestly, and the modesty was correct. Wray claimed the operation shut down "the access it enabled" — the routers — not the campaign. It did not end the actor: the botnet was reported rebuilding within months, the Versa exploitation followed in August 2024, a Singtel intrusion in June 2024 was later characterised (Bloomberg, November 2024, on two unnamed sources) as a test run for attacks on US telecommunications, and LELWD's compromise had already run its full course before any of it. The same pattern APT1 recorded: infrastructure disrupted, operator rebuilt, activity continued.

Wrong, or overstated, or unresolved

1. "Not consistent with traditional cyber espionage" is doing more work than the evidence supports — and the advisory's own siblings undercut it. Salt Typhoon, the PRC campaign inside US telecommunications surfaced later in 2024, is the same country, an overlapping class of target, and unambiguously espionage; the 2025 Annual Threat Assessment names both in a single sentence about "the growing breadth and depth of the PRC's capabilities." Intelligence preparation of the battlefield and intelligence collection are not disjoint activities — a network mapped in order to break it is also a network you can listen to. And the flat claim that the actors do not steal is not true as stated. The advisory's own "do not exfiltrate data" is a characterisation of a pattern in the incidents it had; Dragos's LELWD findings a year later are exfiltration — OT operating procedures and GIS layout data. The defensible version is narrower and much less quotable: what they took has targeting value and almost no intelligence value. The proposal that generated this entry describes it as an "intrusion that steals nothing and breaks nothing," and the first half of that is wrong; correcting it is part of what the entry is for.

2. The confidence label moved two steps without a new class of public evidence. Microsoft, 24 May 2023: moderate confidence, "could disrupt." The US agencies, 7 February 2024: high confidence, "to disrupt functions." In between there is more incident-response data, the botnet takedown, and — plausibly — classified collection that cannot be shown. But the public record does not contain the thing that moves an estimate two steps, and an assessment that is only checkable at one confidence level is not checkable. This is the same failure the sibling entry records in Mandiant's "beyond a reasonable doubt": a judgment wearing a stronger word than its visible procedure earns. The difference cuts against this case rather than for it. Mandiant published its indicators so critics could use them; an intent assessment has no equivalent, because the evidence for intent here is the absence of other evidence, and an absence cannot be published as an indicator.

3. The strongest independent critique is about the political use, and it is unrefuted. Roach, 27 February 2024: China "was 'prepositioning' for future conflict. That is not the same as Russian President Vladimir Putin massing troops on Ukraine's border" — the FBI "is basing its very public alarm purely on conjecture about China's future intent, not on any concrete information of an imminent cyberattack," and circumstantial evidence marshalled for political purposes has a precedent in Iraq. Nothing in the two and a half years since has settled this, and nothing available could, which is the entry's point rather than a complaint about Roach's argument.

4. The Chinese rebuttal is bad, and the entry has to say precisely how rather than wave it away. CVERC, with the National Engineering Laboratory for Computer Virus Prevention Technology and 360 Digital Security Group, published in April, July and October 2024, arguing that Volt Typhoon is an American disinformation campaign and the samples belong to the Dark Power ransomware crew. The move that discredits it is specific: it took Trellix and ThreatMon reports whose indicator sets happened to include a Dark Power hash and treated co-occurrence as identity; ThreatMon said its report had been mischaracterised, and CVERC then presented ThreatMon's correction as evidence of US pressure. SentinelLabs' Dakota Cary, 16 October 2024: the report "provides no new evidence of these claims and rehashes old leaked U.S. intelligence documents," and "tells us more about China's intentions than it does convince readers of the PRC's claims." But note what the rebuttal never had to do. It does not have to be any good for point 3 to stand. A bad denial does not convert an inference into an observation, and a reading that treats "China's rebuttal was garbage" as confirmation of the assessment has made a logical error, not an assessment.

5. The framing's own institutional support has thinned, and that is checkable and dated. The 2025 Annual Threat Assessment named the campaigns: "The PRC's campaign to preposition access on critical infrastructure for attacks during crisis or conflict, tracked publicly as Volt Typhoon…" The 2026 Annual Threat Assessment (March 2026, information as of 14 March 2026) does not. Its entire Cyber section runs two pages and names no campaign at all. The concept survives as a clause — "Both countries are continuing their R&D and pre-positioning efforts to advance their premier cyber attack capabilities for use against the U.S." — and elsewhere the distinction the 2024 advisory was built on is quietly undone: the China Strategic Overview says China "has shown its ability to compromise U.S. infrastructure through formidable cyber capabilities for both espionage and strategic advantage in the event of a conflict," putting the two purposes back on one line. Most consequentially, the China–Taiwan section gives an estimate of the effect that the advisory never gave: if the US intervened it "probably would face significant but recoverable disruptions to its transportation sector from Chinese cyber attacks." One sector, not four, and significant but recoverable is a long way from wreak havoc. Two readings of that change and the entry carries both: either the IC's estimate of the consequence has genuinely come down, or a document with a different editorial posture is under-reporting a threat its own predecessor named. The Foundation for Defense of Democracies took the second view in April 2026. Nothing published settles it. What is not in dispute is that the name is gone and the claim is now a clause.

6. And the claim has not come due, and cannot. As of 19 August 2026 — three years and three months after the naming, two and a half years after the high-confidence assessment — there is no attributed Volt Typhoon disruption of any US critical-infrastructure function. Not one outage. That is precisely what the assessment predicts, because its stated trigger is "a major crisis or conflict with the United States" and no such conflict has occurred; the 2026 ATA separately records that the IC "assesses that Chinese leaders do not currently plan to execute an invasion of Taiwan in 2027, nor do they have a fixed timeline." The interpretation is therefore unfalsifiable on its own terms until the war it names arrives — and its being unfalsifiable is not evidence that it is wrong. Both halves of that sentence have to be carried together, and a reading that carries only one is misusing the entry.

Commonly misused as

Not required for interpretation, but each of these is common enough that a reading meeting it should have the correction to hand.

"Volt Typhoon proves China is about to attack the grid." The assessment's own condition is "in the event of a major crisis or conflict with the United States." It is a claim about what would be available if a conflict began, not a claim that one will. Wray's own formulation contained the conditional — "if and when China decides the time has come to strike" — and the headline versions dropped it.

"Nothing has happened, so it was threat inflation." The interpretation predicts nothing happening. Non-occurrence is the null result the claim was built to survive, which is a serious epistemic weakness and not a refutation. Anyone reaching for this move should also notice they have made the reverse of the mistake in the previous paragraph.

"Only China does this." The clearest counter-instance is American and on the record. Sanger and Perlroth reported in the New York Times on 15 June 2019 that the United States had been placing reconnaissance probes in Russian electric-grid control systems since at least 2012 and had shifted to placing potentially crippling malware, described by officials as partly a warning and partly a posture to be poised for cyberstrikes if a major conflict broke out. That is the same act with the same stated rationale, published by American officials four and a half years before the Volt Typhoon advisory. It does not make the Chinese activity acceptable and it does not make the assessment wrong. It does mean pre-positioning is a described practice of at least two great powers, and a reading that treats it as a uniquely Chinese pathology is not reading the record.

"It was a botnet, and the FBI killed it." The KV botnet was obfuscation infrastructure — dead-end consumer routers used to make traffic look domestic — not the persistence mechanism. Per the March 2024 fact sheet: "Volt Typhoon does not rely on malware to maintain access to networks and conduct their activity. Rather, they use built-in functions of a system." Deleting malware from the routers removed the routers. It did not remove the access, and the actor was operating again inside the year.

"The Five Eyes all confirmed it." They co-sealed it. Read the footnotes: in 2024 Canada assessed it "would likely be affected," and Australia and New Zealand assessed their infrastructure "could be vulnerable to similar activity." Independent allied observation arrives later and separately, with ASIO in November 2025 — which is a stronger fact than the co-seals and should be cited instead of them.

And the one this project must guard against directly. Nothing here is evidence. This entry deposits nothing into the ledger and does not move the needle — not the five-year figure, not the 300 days, not the sector count. It exists so that a reading holding a capability which has not yet done anything must state, in the open, whether it is discounting that capability or crediting it, and why that is the right call for the kind of thing in front of it.

Sources

Primary where reachable. Provenance is marked per source, because several of the most load-bearing documents could not be read from an authoritative host.

Read directly.

• Microsoft Threat Intelligence, "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques," 24 May 2023. The moderate-confidence sentence, the mid-2021 activity date, the sector list and the "espionage and maintain access" sentence are transcribed from it.
• CISA, NSA, FBI, DOE, EPA, TSA, US Treasury, ASD's ACSC, CCCS, NCSC-UK and NCSC-NZ, PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders, marked "As of March 2024" (released 19 March 2024). Read as rendered pages 1–2 from the FBI IC3 copy. Source for the summary paragraph, the eleven co-sealing seals, footnotes 1–4 including the CCCS/ACSC/NCSC-NZ vulnerability assessments and the ten-body composition of the February advisory, and the "does not rely on malware" passage.
• ODNI, Annual Threat Assessment of the U.S. Intelligence Community, March 2026, information as of 14 March 2026. Read as rendered pages from the Senate Select Committee on Intelligence copy: cover and introduction (1–2), contents (3), foreword (4), Technological Challenges — AI and Quantum (12–13), Cyber and WMD (16–17), Asia — China Strategic Overview and China–Taiwan (21–22). Every 2026 ATA quotation above is transcribed from those pages. The remaining pages were not read, so the observation that the campaign names are absent is an observation about the Cyber, AI and China sections — which is where they would be, and where the 2025 report put them.
• Palo Alto Networks Unit 42, "Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)," 14 February 2024. The concurrence with the advisories' attribution.
• SentinelLabs, Dakota Cary, "China's Influence Ops: Twisting Tales of Volt Typhoon at Home and Abroad," 16 October 2024. The assessment of the CVERC reports and both quoted sentences. Note that SentinelOne is a party to the dispute on the Western side.
• Paul Rosenzweig, "Volt Typhoon and the Disruption of the U.S. Cyber Strategy," Lawfare, 5 March 2024. The strategic reading — that the campaign undercuts deterrence-by-symmetrical-threat, and that the small-device attack surface is one the US has no scaled answer to.
• Stephen Roach, "The Drums of US–China Cyber War," 27 February 2024. The conjecture argument, the Putin-on-the-border contrast, the Stuxnet point and the Iraq WMD precedent.
• Jonathan Greig, The Record, 19 February 2026. Rob Lee's remarks on continued Dragos observation of the actor and on compromises that will never be found.
• Martin Matishak and Jonathan Greig, The Record, 31 January 2024. Garland's and Wray's quotations on the KV botnet operation, the December 2023 court order and the router models. Used because the DOJ release itself was unreachable.
• SecurityWeek, "China's Volt Typhoon Hackers Dwelled in US Electric Grid for 300 Days," 12 March 2025. The LELWD dates, dwell time, the FortiGate entry point, and the Dragos characterisation of the exfiltrated OT and GIS data.

Recorded from search results and secondary reporting, not read directly. Each of these is used above and each should be re-verified by a later reading with better access: the AA24-038A advisory text (see the fetch failures below); the 2025 Annual Threat Assessment's sentence naming both campaigns; the FDD's April 2026 critique of the 2026 ATA's omissions; Mike Burgess's 12 November 2025 remarks, taken from ABC News and The Conversation coverage rather than a transcript; Bloomberg's November 2024 Singtel report, which is paywalled and whose "test run" characterisation rests on two unnamed sources in the original; Lumen Black Lotus Labs on the KV botnet and on CVE-2024-39717; and the New York Times report of 15 June 2019 by David E. Sanger and Nicole Perlroth on US implants in the Russian grid.

Fetch failures, recorded per the rule that a failed search is noted and the work continues.

• cisa.gov returned HTTP 403 to this machine throughout. The AA24-038A advisory page, both of its PDF copies on cisa.gov, the media.defense.gov copy, the AA23-144A page and CISA's China threat-actor page were all unreachable. The advisory's wording quoted above is transcribed from a verbatim mirror of the advisory text in a public GitHub indicator repository (Geekmaster-General/IOCs), cross-checked against independent search results reporting the same sentences. This is the entry's most load-bearing source and it was not read from an authoritative host. A later reading with access should re-verify three sentences specifically: the high- confidence assessment about lateral movement to OT assets, the "at least five years" sentence, and "not consistent with traditional cyber espionage or intelligence gathering operations."
• dni.gov's 2025 ATA PDF: 403. The 2025-to-2026 comparison in section 3 rests on a sentence taken from search results.
• justice.gov's press release on the KV botnet operation: 403.
• fdd.org and nationalinterest.org, carrying the same April 2026 critique of the 2026 ATA: 403 and 403.
• iiss.org, "Volt Typhoon's long shadow," January 2026: 403. Nothing is quoted from it above; it is noted only as evidence that the framing persists in specialist analysis.
• industrialcyber.co's account of the Dragos LELWD case study: 403. The Dragos case study itself was not read; its figures reach this entry through SecurityWeek.
• cyber.gov.au's copy of the advisory: request timed out at 60s.
• ncsc.gov.uk: 404 at the guessed path.
• CVERC's own reports were not read. An English PDF of the second is hosted at cverc.org.cn and was not fetched. The account of them above comes entirely from SentinelLabs and from The Record's reporting, both of which are parties to the dispute on one side, and the entry's characterisation of the Chinese argument should be treated as second-hand until someone reads the documents.